| CVE-2025-10346 | 中6.1 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a
stored HTML injection due to lack of proper validation of user input by
sending a POST request in the parameters 'subject' at the endpoint 'knoewledge_base/article'. | 29/09/2025 |
| CVE-2025-10345 | 中6.1 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a
stored HTML injection due to lack of proper validation of user input by
sending a POST request in the parameters 'name' and 'address' at the endpoint 'admin/leads/lead'. | 29/09/2025 |
| CVE-2025-10344 | 中6.1 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a
stored HTML injection due to lack of proper validation of user input by
sending a POST request in the parameters 'name' and 'clientid' at the endpoint '/projects/project/x'. | 29/09/2025 |
| CVE-2025-10343 | 中6.1 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a
stored HTML injection due to lack of proper validation of user input by
sending a POST request in the parameter 'expense_name' at the endpoint '/expenses/expense'. | 29/09/2025 |
| CVE-2025-10342 | 中6.1 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a
stored HTML injection due to lack of proper validation of user input by
sending a POST request in the parameter 'name' at the endpoint '/subscriptions/create'. | 29/09/2025 |
| CVE-2025-10341 | 中6.1 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a
stored HTML injection due to lack of proper validation of user input by
sending a POST request in the parameter 'company' at the endpoint '/clients/client/x. | 29/09/2025 |
| CVE-2025-3219 | 中5.4 | A vulnerability was found in CodeCanyon Perfex CRM 3.2.1. It has been classified as problematic. Affected is an unknown function of the file /perfex/clients/project/2 of the component Project Discussions Module. The manipulation of the argument description leads to cross site scripting. It is possible to launch the att | 04/04/2025 |
| CVE-2025-2974 | 中5.4 | A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely. The exploit has been | 31/03/2025 |
| CVE-2024-8867 | 中5.4 | A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers/Clients.php of the component Parameter Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. Th | 15/09/2024 |
| CVE-2024-44851 | 中5.4 | A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter. | 11/09/2024 |
| CVE-2021-40303 | 中5.4 | perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile. | 08/11/2022 |
| CVE-2020-28961 | 中5.4 | Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter. | 22/10/2021 |
| CVE-2017-17976 | 緊急9.8 | In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution. | 26/01/2018 |